Devpebe Radar — Node.js

Node.js — 2026-08

Wed, 19 Aug 2026 00:00:00 GMT

v26.7.0 — Aug 5, 2026

Perfetto tracing support; private keys loadable through OpenSSL STORE loaders; Symbol.dispose implemented in ModuleHooks; new --test-coverage-include-all.

v26.6.0 — Aug 3, 2026

The test runner gains context.log and a test:log event; ffi gets getCurrentEventLoop.

v24.19.0 — Aug 3, 2026

LTS backports: blob.textStream, --experimental-import-text, TCP_KEEPINTVL/TCP_KEEPCNT, and the httpValidation option.

Node.js — 2026-07

Fri, 31 Jul 2026 00:00:00 GMT

v26.5.1 — Jul 29, 2026

⚠ Security release (10 CVEs, two High: HTTP/2 RST-stream deferral, permission-model radix nodes) — same patches in 24.18.1 and 22.23.2.

v26.5.0 — Jul 8, 2026

blob.textStream and an exposed ReadableStreamTee; new --experimental-import-text flag; TLS reports negotiated groups.

Node.js — 2026-06

Tue, 30 Jun 2026 00:00:00 GMT

v26.4.0 — Jun 24, 2026

Package maps land in the loader, and a minimal node:vfs subsystem appears (with node:fs/promises dispatching to mounted VFS instances).
setKeepAlive supports TCP_KEEPINTVL/TCP_KEEPCNT; TLS gets a certificateCompression option; readFile accepts caller-supplied buffers.

v26.3.1 — Jun 18, 2026

⚠ Security release (10 CVEs, two High: TLS hostname normalization for server identity checks, WebCrypto cipher output-length guard) — same patches in 24.17.0 and 22.23.0.

v26.3.0 — Jun 1, 2026

New permission.drop to shed permissions at runtime; httpValidation option configures header-value validation; Buffer.poolSize default grows to 64 KiB.

Node.js — 2026-05

Sun, 31 May 2026 00:00:00 GMT

v26.0.0 — May 5, 2026

⚠ Node 26 is out. New language features via V8: Map/WeakMap getOrInsert / getOrInsertComputed (upsert proposal) and Iterator.concat.
⚠ End-of-life for legacy _stream_* modules and http.writeHeader; module.register runtime-deprecated; --experimental-transform-types removed.
assert accepts printf-style messages in assertion errors.

v26.2.0 — May 20, 2026

Temporal.Instant support in fs.Stats; http.writeInformation sends arbitrary 1xx status codes; stream.compose marked stable.
Web Cryptography wires ML-DSA, ML-KEM, ChaCha20-Poly1305, and AES-KW when built against BoringSSL.

v26.1.0 — May 7, 2026

crypto.randomUUIDv7; req.signal on IncomingMessage; a signal option for fs.stat; process throws on execve(2) failure instead of aborting.

v24.16.0 — May 21, 2026

LTS backports: randomUUIDv7, test-order randomization in the test runner, and edit-free runtime expression probes in node inspect.

Node.js — 2026-04

Thu, 30 Apr 2026 00:00:00 GMT

v24.15.0 — Apr 16, 2026

LTS catches up: require(esm) and the module compile cache are stable, --max-heap-size, raw key formats in the KeyObject APIs, and a throwIfNoEntry option for fs.stat.

v25.9.0 — Apr 1, 2026

AsyncLocalStorage gets using scopes (explicit resource management).
TurboSHAKE and KangarooTwelve land in Web Cryptography; SEA supports a code cache for ESM entrypoints; experimental stream/iter implementation.

Node.js — 2026-03

Tue, 31 Mar 2026 00:00:00 GMT

v25.8.2 — Mar 24, 2026

⚠ Security release across all lines (9 CVEs, two rated High: SNICallback error handling, null-prototype headersDistinct/trailersDistinct) — also shipped as 24.14.1, 22.22.2, and 20.20.2.

v25.8.0 — Mar 3, 2026

New --permission-audit flag; SQLite DatabaseSync gets a limits property; the test runner exposes a worker ID for concurrent runs.

Node.js — 2026-02

Sat, 28 Feb 2026 00:00:00 GMT

v25.7.0 — Feb 24, 2026

SEA supports an ESM entry point; SQLite marked release candidate.
http2 gets http1Options for HTTP/1-fallback configuration.
⚠ Duplex.toWeb renamed its type option to readableType.

v24.14.0 — Feb 24, 2026

LTS picks up the recent Current features: fs.watch ignore option, http.setGlobalProxyFromEnv, subpath imports starting with #/, and the trackPromises option in async_hooks.createHook.

v25.6.0 — Feb 3, 2026

async_hooks.createHook gets trackPromises; node:stream/consumers gets bytes; the test runner’s run() accepts an env option.
Initial ESM support in the embedder API; Socket gains setTOS/getTOS.

Node.js — 2026-01

Sat, 31 Jan 2026 00:00:00 GMT

v25.5.0 — Jan 26, 2026

fs.watch gets an ignore option — skip paths without hand-rolled filtering in the watcher callback.
--build-sea generates single-executable applications directly with the Node binary.
SQLite: defensive mode enabled by default, and prepare accepts options.

v25.4.0 — Jan 19, 2026

require(esm) is now stable.
New http.setGlobalProxyFromEnv — proxy configuration from env vars without an agent package.
New --require-module/--no-require-module CLI flags; events.listenerCount now accepts EventTargets.

v25.3.0 — Jan 13, 2026

⚠ Security release across all lines (7 CVEs) — TLS socket default error handler, stricter symlink permission checks, async_hooks stack-overflow handling. Same patches shipped to 24.13.0, 22.22.0, and 20.20.0 LTS.

Node.js — 2025-12

Wed, 31 Dec 2025 00:00:00 GMT

Version 24.12.0 ‘Krypton’ (LTS) — Dec 10, 2025

Type stripping marked stable on the LTS line.
Permission model gains --allow-inspector; compile cache can be made portable.
v8: CPU profile API.

Node.js — 2025-11

Sun, 30 Nov 2025 00:00:00 GMT

Version 25.2.0 (Current) — Nov 11, 2025

TypeScript type stripping is stable.
util.deprecate gains options; v8.HeapStatistics adds total_allocated_bytes.
node-api: napi_create_object_with_properties.
Network family autoselection timeout raised to 500ms.

Node.js — 2025-10

Fri, 31 Oct 2025 00:00:00 GMT

Version 25.1.0 (Current) — Oct 28, 2025

http: optimizeEmptyRequests server option; sqlite gains a defensive flag; new watch config namespace.

Version 22.21.0 ‘Jod’ (LTS) — Oct 20, 2025

Built-in HTTP proxy support in http/https.request and Agent, plus --use-env-proxy / NODE_USE_ENV_PROXY for fetch.
--max-old-space-size accepts percentages.

Version 25.0.0 (Current) — Oct 15, 2025

--allow-net permission added to the permission model.
Web Storage unflagged (--experimental-webstorage on by default); global ErrorEvent exposed.
⚠ End-of-life sweep: SlowBuffer, assert.CallTracker, multi-argument assert.fail, child_process._channel, and the bound-function asyncResource property are gone.

Version 24.10.0 (Current) — Oct 11, 2025

sqlite: authorization API; console accepts per-stream inspectOptions.

Node.js — 2025-09

Tue, 30 Sep 2025 00:00:00 GMT

Version 24.9.0 (Current) — Sep 25, 2025

http.shouldUpgradeCallback lets servers control HTTP upgrades.
sqlite: tagged-template support, plus ERM cleanup and an exported Session class.
worker: new heap profile API.

Version 22.20.0 ‘Jod’ (LTS) — Sep 24, 2025

Brotli lands in CompressionStream / DecompressionStream on the LTS line.
test_runner: object property mocking.
http: new Agent.agentKeepAliveTimeoutBuffer option; http2 gains raw header arrays in h2Stream.respond.
SEA (single executable apps): execArgv / execArgvExtension in the config.

Version 24.8.0 (Current) — Sep 10, 2025

Post-quantum crypto wave: SLH-DSA KeyObject/sign/verify, Ed448 and ML-DSA context parameters in both node:crypto and Web Cryptography.
Argon2 and KMAC algorithms added to Web Cryptography.
worker: CPU profile APIs.

Node.js — 2025-08

Sun, 31 Aug 2025 00:00:00 GMT

Version 24.7.0 (Current) — Aug 27, 2025

Post-quantum crypto lands: ML-KEM (FIPS 203) via new crypto.encapsulate/crypto.decapsulate, ML-DSA (FIPS 204) in crypto.sign/verify, plus ChaCha20-Poly1305, subtle.getPublicKey, and SubtleCrypto.supports.
execArgv policies for embedders: "none", "cli" (--node-options="…"), or "env" (default, NODE_OPTIONS).

Version 24.6.0 (Current) — Aug 14, 2025

NODE_USE_SYSTEM_CA=1 — use the system CA store.
zlib: dictionary support in zstdCompress/zstdDecompress; fs gains Utf8Stream (SonicBoom ported into core).
http: new server.keepAliveTimeoutBuffer option.

Version 22.19.0 ‘Jod’ (LTS) — Aug 28, 2025

--experimental-wasm-modules unflagged; tls.setDefaultCACertificates and process.threadCpuUsage added.

Node.js — 2025-07

Thu, 31 Jul 2025 00:00:00 GMT

Version 24.5.0 (Current) — Jul 31, 2025

worker: Web Locks API added.
dns: support max timeout; --cpu-prof-name accepts a ${pid} placeholder.
net.blocklist gains file save and file management.

Version 22.18.0 ‘Jod’ (LTS) — Jul 31, 2025

import.meta.main implemented.
Permission model flags propagate on spawn, plus permission.has(addon).
sqlite: readBigInts option at connection level; new --watch-kill-signal flag.

Version 24.4.0 (Current) — Jul 9, 2025

fs: disposable mkdtempSync.
crypto.hash supports outputLength for XOF functions.

Node.js — 2025-06

Mon, 30 Jun 2025 00:00:00 GMT

Version 24.3.0 (Current) — Jun 24, 2025

Type stripping loses its experimental warning.
test_runner: support object property mocking.
url: new fileURLToPathBuffer API.

Version 24.2.0 (Current) — Jun 9, 2025

Symbol.dispose/asyncDispose graduate from experimental.
⚠ http: deprecate instantiating classes without new; util.isNativeError deprecated in favor of Error.isError.
Config file gains namespace options support; FileHandle readableWebStream gets an autoClose option.

Version 22.17.0 ‘Jod’ (LTS) — Jun 25, 2025

assert.partialDeepStrictEqual marked stable.

Version 20.19.3 ‘Iron’ (LTS) — Jun 23, 2025

WebCrypto Ed25519 and X25519 graduate as stable.

Node.js — 2025-05

Sat, 31 May 2025 00:00:00 GMT

Version 24.0.0 (Current) — May 6, 2025

Node 24 lands: Float16Array, explicit resource management, RegExp.escape, WebAssembly Memory64, and Error.isError.
⚠ Runtime deprecation of url.parse — use the WHATWG URL API instead.
⚠ Removal of deprecated tls.createSecurePair; runtime deprecations of SlowBuffer and instantiating REPL without new.

Version 22.16.0 ‘Jod’ (LTS) — May 21, 2025

import.meta properties graduate from experimental, along with multiple other APIs.
Top-level Wasm support without package type.
sqlite: StatementSync.prototype.columns.
Config file support — default config as node.config.json.

Version 24.1.0 (Current) — May 21, 2025

fs: Dir gains support for explicit resource management.

Node.js — 2025-04

Wed, 30 Apr 2025 00:00:00 GMT

Version 22.15.0 ‘Jod’ (LTS) — Apr 23, 2025

System certificate stores: --use-system-ca on Windows, plus reading certificates from the macOS system store.
assert implements partial error comparison; DNS gains TLSA record query and parsing.

Version 23.11.0 (Current) — Apr 1, 2025

New process.execve.
StatementSync.prototype.columns in node:sqlite; optional callback on crypto.diffieHellman.
The diff function behind assertion errors is exposed in util.

Node.js — 2025-03

Mon, 31 Mar 2025 00:00:00 GMT

Version 23.10.0 (Current) — Mar 13, 2025

New tls.getCACertificates and v8.getCppHeapStatistics.
--use-system-ca supports intermediate certs; test_runner’s TypeScript default glob changed.

Version 20.19.0 ‘Iron’ (LTS) — Mar 13, 2025

require(esm) lands on the 20.x line: the module-sync exports condition, __esModule on require’d ESM, and process.features.require_module.
worker.postMessageToThread backported.

Node.js — 2025-02

Fri, 28 Feb 2025 00:00:00 GMT

Version 23.9.0 (Current) — Feb 26, 2025

dns: TLSA record query and parsing.
New process.threadCpuUsage.
--cpu-prof* flags allowed in NODE_OPTIONS; --use-system-ca now works beyond Windows/macOS.

Version 22.14.0 ‘Jod’ (LTS) — Feb 11, 2025

New module.findPackageJSON util.
LTS picks up the recent Current-line features: TypeScript in STDIN eval, glob patterns in the fs exclude option, process.ref/unref, and TypedArray/DataView in node:sqlite.

Version 20.18.3 ‘Iron’ (LTS) — Feb 10, 2025

Import attributes and JSON modules marked stable on the 20.x line.

Node.js — 2025-01

Fri, 31 Jan 2025 00:00:00 GMT

Version 23.7.0 (Current) — Jan 30, 2025

fs: the exclude option in globs now accepts glob patterns.
sqlite: StatementSync supports TypedArray and DataView.
test_runner: new TestContext.prototype.waitFor, t.assert.fileSnapshot, and assert.register APIs.

Version 23.6.1 (Current) — Jan 21, 2025

⚠ Security release across all lines (also 22.13.1, 20.18.2, 18.20.6): CVE-2025-23083 — InternalWorker use now throws when the permission model is enabled (High); CVE-2025-22150 — insufficiently random values in undici fetch (Medium); plus a Windows path.normalize traversal fix.

Version 23.6.0 (Current) — Jan 7, 2025

TypeScript support in STDIN eval and worker eval input.
New process.ref and process.unref methods.

Version 22.13.0 ‘Jod’ (LTS) — Jan 7, 2025

node:sqlite unflagged on the LTS line.
New assert.partialDeepStrictEqual.
--trace-env and --trace-env-[js|native]-stack CLI flags.
util.styleText stabilized; the require(esm) warning now only emits under --trace-require-module.